AWS Certificate Manager (ACM)

AWS Certificate Manager (ACM) is a service that lets you easily provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services and your internal connected resources. SSL/TLS certificates are digital certificates that enable encrypted communication between a client (like a web browser) and a server. They are essential for HTTPS, which secures data in transit.

Before ACM, managing certificates was a manual, error-prone process. You had to generate a Certificate Signing Request (CSR), submit it to a Certificate Authority (CA), wait for validation, install the certificate on your server, and track expiration dates. If a certificate expired, your website would show security warnings, driving away customers. ACM automates these tasks, reducing the risk of human error and saving time.

ACM integrates natively with several AWS services, including:

ACM does not support using certificates directly on Amazon EC2 instances (you must export or use a different solution). This is a common exam trap.

ACM operates in two modes: public certificates and private certificates.

Public Certificates: ACM acts as a public Certificate Authority (CA) trusted by major browsers and operating systems. When you request a public certificate, ACM handles the entire lifecycle: 1. Request: You specify the domain name(s) you want to secure (e.g., example.com, www.example.com). You can request a certificate for a fully qualified domain name (FQDN) or a wildcard (e.g., *.example.com). 2. Validation: You must prove you own or control the domain. ACM supports two validation methods: - DNS validation: You add a specific CNAME record to your DNS configuration (e.g., in Amazon Route 53 or another DNS provider). ACM checks for this record to confirm ownership. - Email validation: ACM sends validation emails to three addresses for each domain: administrator@, hostmaster@, postmaster@, plus one WHOIS contact. You must click a link in the email. 3. Issuance: Once validated, ACM issues the certificate from its trusted CA (Amazon Trust Services). The certificate is stored in ACM and is automatically renewed if you use DNS validation and the CNAME record remains in place. 4. Deployment: You associate the certificate with an integrated AWS service (e.g., ALB listener). ACM automatically deploys the certificate to the service. 5. Renewal: ACM attempts to renew certificates 60 days before expiration. For DNS validation, renewal is automatic if the CNAME record exists. For email validation, you must re-approve manually.

Private Certificates: ACM Private Certificate Authority (ACM PCA) allows you to create a private CA hierarchy to issue certificates for internal use (e.g., for internal applications, IoT devices, or code signing). These certificates are not trusted by public browsers. You can issue certificates for internal domain names like internal.example.com. ACM PCA is a separate service with its own costs.

Public certificates provisioned through ACM are free. You only pay for the AWS resources that use them (e.g., load balancers, CloudFront distributions). However, if you import your own certificate into ACM, you are charged a monthly fee per certificate (currently $0.75/month per certificate after the first 1,000 imported certificates, but check current pricing).

ACM PCA has costs for:

Limits: - Default limit of 2,500 public certificates per AWS account per region (soft limit, can be increased) - Maximum certificate chain length: 5 (including the root CA) - ACM public certificates have a maximum validity of 13 months (395 days) as of 2020 (industry standard). Private certificates can have longer validity. - ACM supports RSA 2048, RSA 4096, and Elliptic Curve (EC) keys.

Traditionally, you would purchase certificates from a public CA like DigiCert or Let's Encrypt. Let's Encrypt provides free certificates but requires automated renewal via the ACME protocol. ACM simplifies this by integrating directly with AWS services. With ACM, you don't need to manage certificate files or renewal scripts. The trade-off is that ACM certificates cannot be exported for use on non-AWS resources (except for use with AWS CloudFront via a special export). If you need a certificate for an EC2 instance, you must either use ACM PCA (which allows export) or purchase a certificate from another CA.

aws acm request-certificate \
    --domain-name example.com \
    --validation-method DNS \
    --subject-alternative-names www.example.com \
    --idempotency-token 1234

This command returns a certificate ARN. Then you can describe the certificate to get the CNAME record for DNS validation:

aws acm describe-certificate --certificate-arn arn:aws:acm:us-east-1:123456789012:certificate/abc-123

Resources:
  MyCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: example.com
      SubjectAlternativeNames:
        - www.example.com
      ValidationMethod: DNS

This creates a certificate that requires manual DNS validation (you must add the CNAME record to your DNS zone).

A medium-sized e-commerce company runs its website on EC2 instances behind an Application Load Balancer. They need HTTPS to secure customer transactions. The team uses ACM to request a public certificate for their domain (shop.example.com). They choose DNS validation because they use Route 53 for DNS. ACM automatically validates and issues the certificate. They then associate the certificate with the ALB's HTTPS listener. The ALB terminates TLS, so the backend EC2 instances communicate via HTTP internally (or they can use a second certificate for internal encryption). The certificate is automatically renewed every 13 months, so the team never has to worry about expiration. Cost: The certificate is free; they only pay for the ALB and EC2 instances. If they had used a third-party CA, they would pay $50–$300 per year per certificate and would need to manually renew and install.

A financial services company has multiple internal microservices communicating over a private network. They need TLS to encrypt traffic between services. They use ACM Private Certificate Authority to create a private CA. They issue certificates for each microservice's internal DNS name (e.g., payments.internal.example.com). They use AWS CloudMap or internal Route 53 to resolve names. The certificates are deployed on EC2 instances using an automation script that calls the ACM PCA API to issue and export certificates. Because the certificates are private, they are not trusted by public browsers, but within the company's trust store, they are valid. This approach is cheaper than buying public certificates for internal names and allows for automated issuance and renewal. Cost: Monthly fee for the private CA ($400/month for the first CA, plus per-certificate fees). This is acceptable for a company with many internal services.

A startup uses ACM with email validation for their main domain. They receive an email for validation and approve it. The certificate is issued and associated with their CloudFront distribution. After 11 months, the certificate is due for renewal. ACM sends renewal emails, but the startup's email server filters them as spam. The team misses the renewal deadline. The certificate expires, and users see a 'Your connection is not private' warning. Traffic drops by 40% until they manually request a new certificate and update the CloudFront distribution. This could have been avoided by using DNS validation, which automates renewal without email intervention. The lesson: always prefer DNS validation for production workloads.